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Abstract 

NASA Headquarters' Office of Advanced 
Concepts and Technology (OACT) joined efforts 
with Johnson Space Center's (JSC) Automation 
and Robotics Division and Langley Research 
Center’s (LaRC) Information Systems Division to 
capture the technologies developed during the 
canceled NASA Flight Telerobotic Servicer (FTS) 
program planned for use on Space Station 
Freedom. The recent FTS Technology Capture 
effort completed the build and testing of one flight 
qualifiable FTS manipulator, deliverable to JSC's 
Automation & Robotics Division for environmental 
testing. The many robotic technologies 
developed to meet the 30 year space environment 
design requirements are discussed in this paper. 
The manipulator properties were to allow 
positioning control to one thousandths of an inch, 
with zero actuator backlash over a temperature 
range of -50 to +95 degrees C, and were to include 
impedance control and inertial de-coupling. Safety 


and reliability requirements are discussed that were 
developed to allow a thirty year life in space with 
minimum maintenance. The system had to meet 
the safety requirements for hazardous payloads for 
operation in the Shuttle Payload Bay during 
demonstration test flights prior to Station use. A 
brief description is contained on an Orbiter based 
robotic experiment and operational application 
using the dexterous FTS manipulator operating on 
the end of the Shuttle Remote Manipulator 
Systems (SRMS) from ground control. 

Anticipated Mission Tasks 

The original FTS concept for Space Station 
Freedom (SSF) was to provide telerobotic 
assistance to enhance crew activity and safety, and 
to reduce crew EVA (Extra Vehicular Activity) 
activity. The first flight of the FTS manipulator 
systems would demonstrate several candidate 
tasks and would verify manipulator performance 
parameters. These first flight tasks included 



Figure 1 - FTS Manipulator on Air Bearing Table 
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unlocking a SSF Truss Joint, mating/de-mating a 
fluid coupling, contact following of a contour board, 
demonstrating peg-ln-hole assembly, and grasping 
and moving a mass. Future tasks foreseen for the 
FTS system included ORU (Orbit Replaceable Unit) 
change-out, Hubble Space Telescope Servicing, 
Gamma Ray Observatory refueling, and several in- 
situ SSF servicing and maintenance tasks. 
Operation of the FTS was planned to evolve from 
teleoperation to fully autonomous execution of 
many tasks. The FTS manipulator has been 
assembled at Martin Marietta (see Figure 1) and will 
be delivered to NASA/JSC (Johnson Space 
Center). Successful component tests indicate a 
manipulator which achieves unprecedented 
performance specifications. 

Currently anticipated tasks for dexterous space 
manipulators still focus on reducing EVAs as well 
as enhancing crew activity and safety. The Space 
Station (Freedom ?) plans to utilize a dexterous 
manipulator, SPDM (Special Purpose Dexterous 
Manipulator), on the SSRMS (Space Station 
Remote Manipulator System) to perform 
maintenance tasks such as replacement of ORUs. 
A potential being Investigated for use on the 
Space Shuttle in assistance with EVA worksite 
setup and teardown. The first and last portion of 
most EVAs consist of placing or retrieving PFRs 
(Portable Foot Restraints), Tool Boards, and other 
devices needed to support EVA tasks. Other 
possible uses for dexterous manipulators include 
contingency use to avoid additional EVA crew 
intervention. The FTS manipulator requirements 
and designs are examples by which to assist in 
understanding current dexterous manipulator 
tasks and plans. 

The wide range of FTS mission tasks combined 
with the desire to evolve toward full autonomy 
forced several extremely demanding 
requirements. Some of these requirements may 
be excessive to telerobotics community, but the 
FTS requirements appear to have been created to 
accommodate an open-ended evolution. This 
operational evolution would not be impeded by 
functional limitations in the FTS manipulator 
systems. Many of the FTS requirements 
discussed in the following sections greatly 
influenced the development cost and schedule of 
the FTS manipulator. A recommendation arising 
from the FTS program to remedy the possible 
impacts from such ambitious requirements is to 
better analyze candidate robotic tasks. Based on 
these task analyses, then weigh the operational 
impacts against development impacts prior to 
requirements definition. 


Functional Requirements 

The functional requirements of the FTS 
manipulator involve environmental, performance, 
safety, and resource effects. Many of these 
requirements are driven by the space 
environment, such as operation in thermal 
extremes, the need for safety, and limited resource 
availability (weight and power). Many of these 
requirements, however, focus on the manipulator 
and component functions to insure superior 
performance and ability to upgrade (evolution 
toward autonomy). 

The primary robotic function of the FTS 
manipulator is that it move or manipulate objects in 
zero-gravity. Because interchangeable end- 
effectors were being considered, the manipulator 
requirements specify the tool-plate as the point of 
reference (see Figure 2 for FTS manipulator 
dimensions and components.) The tool plate is 
the attachment point for the wrist force/torque 
sensor. A manipulated object's mass may be as 
high as 37 slugs (1200 lb.) with the manipulator 
able to move masses less that 2.8 slugs (90 lb.) at 
velocities of 6 inch/second. Unloaded tool plate 
velocity will be at least 24 inch/second. Accuracy 
of tool-plate positioning relative to the manipulator 
base frame must be within 1 inch and ± 3 degrees. 
The manipulator must be able to resolve tool-plate 
incremental motion within 0.001 inch and 0.01 
degrees. (Of coarse, verification tests of such 
extreme resolution specifications is costly.) 
Additionally, repeatability must be within 0.005 
inch and ± 0.05 degrees with respect to the 
manipulator base frame. To perform useful work, 
the FTS manipulator was required to provide 20 
pounds force and 20 foot-pounds torque output at 
the tool plate in any direction and in any 
manipulator configuration. These output force and 
positioning requirements were to be utilized with 
several control schemes including joint-by-joint, 
Cartesian, and impedance control. 

To operate in space, the FTS manipulator had to 
meet the shuttle safety requirements as well as the 
environmental extremes. The safety 
requirements, as discussed later in this paper, 
ensure Orbiter and crew safety through fault 
tolerance. Safety is cited by Shattuck and Lowrle 
[1992] as "the single largest factor driving the 
system design.* Safety and fault tolerance 
requirements resulted in monitoring of joint and 
Cartesian data, in checking of loop times to ensure 
proper functioning, in cross-strapping along 
communication paths, and in the addition of a 
hardwire control capability as a backup operational 



mode. Orbiter launch and landing Impart vibration 
into the system which requires structural analysis 
and testing. Electromagnetic interference (EMI) 
must be limited both from Invading and from exiting 
the manipulator systems. However, the most 
demanding aspect of the space environment from 
the FTS designer's view is the thermal vacuum of 
space. Operation in a hard vacuum (10‘ 5 torr) and 
over temperatures from -50°C to 95°C, with 
directional heating and gradients, forced 
innovative designs, careful material selection, and 
extensive analysis. 

Another consequence of the space environment 
is operation in zero-gravity. Designing the 
manipulator for a zero-g environment impacts 
structural, electromechanical, and electrical power 
considerations and well as the control system 
design. Because weight is a premium in space, 
motors are chosen to provide torque's for zero-g 
operation. This saves significant weight and 
electrical power when compared to motors chosen 
for ground-based operation. Smaller motors also 
benefit the thermal control system. The structure 
must also be lightweight, which increases flexibility 
and lowers structural bending mode frequencies. 
While being lightweight and more flexible, space 
manipulators are expected to handle payloads 
more massive than the manipulator. This 
expectation is far different from terrestrial 


manipulators which usually handle payloads less 
than 1/10 the manipulator weight. To maintain 
stability and performance of the FTS system, a 
10:1 ratio is maintained between the first bending 
mode and the control bandwidth. This ratio 
precludes use of high bandwidth PID servos used 
In more massive, terrestrial manipulators. To 
address the stability and performance issues in the 
FTS manipulator, the structure was designed for 
stiffness (12 Hz first bending mode) and the 
manipulator control has a 1 .2 Hz bandwidth, an 
inertia decoupler, and joint-level position, velocity, 
and torque servo control loops. 


Manipulator Design Technologies 

Beyond safety, FTS manipulator design was driven 
by the thermal environment and the positioning 
performance specifications. Of course, each 
manipulator subsystem was influenced by 
additional constraints and specifications. The 
following paragraphs describe the manipulator 
subsystem designs and technologies developed 
by Martin Marietta and its subcontractors to meet 
the FTS requirements and specifications. 
Manipulator subsystems discussed include 
manipulator kinematic design, link structure, 
actuators, control systems, and the end-of-arm 
tooling. 




Figure 2 - Manipulator Dimensions & Components 




Manipulator Kinematics 

A 7-DOF (degree-of-freedom) R-Y-P-P-P-Y-R 
design is used with the first joint (shoulder roll) 
utilized for task-dependent configuration 
optimization. The outer 6 joints are actively 
controlled for coordinated output motion. The 
kinematic design has minimal joint offsets and 90° 
twist angles to simplify the kinematics. The 6-DOF 
kinematic arrangement, with three adjacent pitch 
joints, provides a closed-form Inverse kinematic 
solution with few singularities within the 
manipulator workspace. The singularities which 
occur when the wrist roll or wrist yaw align with the 
shoulder yaw are beyond the usual workspace of 
the manipulator. Other singularities occurring at 
joint limits and when the elbow passes over the 
"home* position (see Figure 3), shown below, are 
eliminated with mechanical and software joint travel 
limits. The 3 inch displacement of the elbow Joint is 
to allow the arm to fold back on itself for a greater 
workspace. 

Link Structure 

The manipulator links provide structural support as 
well as joint controller electronics packaging and 
thermal control. Packaging and thermal control 
determined link sizes while fracture and stiffness 
considerations drove the structural design of the 
links. A stiffness requirement of 1,000,000 
pounds/foot and 1 ,000,000 foot-pounds/radian 
resulted in a smallest structural safety margin which 
exceeds 14, far greater than Shuttle requirement 
for a 1.4 factor of safety. Easy access to 
electronics Is through side plates on the links. To 
avoid the cost and complication of active cooling, 
radiation is the primary thermal path. The controller 
boards sit in slots within the links which provide 
conduction paths to the link structure for radiation 
to the environment. Figure 4 shows the links and 
the computer cards which fit within the links. The 
link designs use material coatings, mounting 
hardware, and Kapton/lnconel film heaters to 
maintain theimal control. 

Actuators 

The joint actuator designs, developed by Martin 


Marietta and Schaeffer Magnetics, were also driven 
by positioning, performance, and thermal 
demands. These high-performance, zero backlash 
actuators each house a DC-motor, harmonic drive 
transmission, output torque sensor, output 
position sensor, fail-safe brake, hard-stops, and 
internally routed cabling. The design achieves 
considerable commonalty between actuators. 
Three sizes are used - one for the 3 shoulder 
joints, one elbow Joint, and one for the 3 wrist 
joints. 

The DC-motors have brushless, delta-wound 
stators with samarium cobalt rotors. This design 
offers good thermal properties, low EMI, minimal 
rotational losses, and linear torque-speed 
relationships. Motor commutation signals are 
generated from Hall Effect sensors, a second set 
of which is installed for redundancy. A secondary 
set of windings within the stator, driven via an 
independent electrical path, provides at least 1 0% 
rated torque and 0.5 degrees/second joint velocity 
for operation of a backup mode. This degraded 
mode of operation, commanded joint-by-joint 
satisfies the need for safing the manipulator after 
failure of a primary system. Fail-safe brakes 
attached to the motor rotor shaft are spring-loaded 
so that loss of power engages the brake. These 
brakes may be released with an EVA release bolt, 
which when turned 90° releases a cam on the 
brake armature. 

Harmonic drives provide 100:1 backdrivable gear 
reduction In a compact volume. The harmonic 
drives were chosen for torsional stiffness and zero 
backlash. Cup size is determined by joint torsional 
stiffness requirements. In fact, because of the 
relative flexibility of the harmonic drive, all other 
torsion members are considered rigid. Rather than 
the standard Oldham coupling to the wave 
generator, a specially designed cylindrical coupler 
was used to eliminate backlash. Additionally, the 
output is coupled to a flange around the motor and 
harmonic drive. This flange, mounted to large 
duplex bearings provides compactness, rigidity, 
and an efficient load path to the output link. 




An analog torque loop Is Implemented In the joint 
servos to accommodate the non-linear and high- 
frequency affects of the harmonic drives. Sensed 
torque values come from an output torque sensor 
embedded on the harmonic drive output flange. 
Strain gages are mounted to the spokes of the 
titanium flange. This sensor placement isolates the 
sensor from structural loads (bending), thus 
primarily transmitting actuator torque. For effective 
performance, this analog torque loop operates at 
1500 Hz. 

Like the manipulator structure, the actuator 
housings and bearings were designed for stiffness 
and thermal stability. A standard bearing steel, 
440C stainless, is used for all bearings. Bearing 
lubricant is Braycote 601, a liquid lubricant used in 
space applications. Its very low vapor pressure 
allows the actuator to be vented rather that sealed, 
but was still designed to resist contamination and 
assembly in a clean room. The motor bearings are 
deep-groove roller bearings sized for the thrust 
load of brake engagement and spring pre-loaded 
to minimize temperature sensitivity. The output 
bearings are large diameter, duplex-pair, angular 
contact bearings (face-to-face mounting). These 
bearings share radial and thrust loads with another 
duplex-pair on the other side of the actuator. An 
exception is the wrist roll, which has a single, 
duplex pair mounted back-to-back for better rigidity 
against the bending moments of the full cantilever 
load. Unfortunately, this back-to-back installation 
has greater sensitivity to assembly misalignments. 
This sensitivity may contribute to the excessive, 


uncompensated friction discovered during recent 
wrist roll torque loop tests. 

The actuator housings are aluminum and titanium. 
Titanium is utilized near bearings. The similar 
thermal properties of 440C stainless and 6AI-4V 
titanium minimize temperature effects on bearing 
pre-loads. These pre-loads were determined as a 
compromise between stiffness and friction drag. 
The actuator case was designed for thermal needs. 
Motor and brake heat is dissipated to the ends or to 
the casing and then radiated to the environment. 
Like the links, the actuator design uses thermal 
isolation, material coatings, and Internally mounted 
film heaters to protect bearings from thermal 
gradients. These gradients could adversely affect 
actuator friction and positioning accuracy. 

The positioning and incremental motion 
requirements call for encoder data within an arc- 
minute which required position resolutions to 22- 
bits. To meet this need, inductive encoders were 
developed specifically for the FTS program by 
Aerospace Controls Corporation. These encoders 
have a fine and a coarse track used for incremental 
and absolute position resolution, respectively. 
Temperature effects on sensor accuracy were 
discovered during thermal testing. These errors 
were stable and repeatable with temperature, and 
are thus correctable In software. 

All cabling in the manipulator is internally routed 
through the links and actuators. Each actuator has 
a cable passageway designed to eliminate twisting 



Figure 4 - FTS Manipulator Links and Controller Cards 


of cabling, thus minimizing chafing opportunity. 
The Innovative cabling within these actuators is of 
Flat Conductor Cables (FCC), manufactured by 
Tayco, Inc. FCC is used in space applications, but 
for this application up to 34 layers of laminated 
cables are used in a single actuator passageway. 
The cables consist of alternating layers of Kapton, 
FEP, and photo etched copper conductors with a 
vapor-deposited copper shield. These cables are 
to operate from -50°C to 95°C through thousands 
of cycles. These cables route serial data, video 
signals, power, and discrete signals. Acceptance 
tests of a few cables indicated minor lamination 
problems apparently due to entrapped water 
vapor. Investigation of the cable manufacture and 
tests of additional cables indicated several areas for 
possible change as well as a method for cable 
repair. Recent cable tests to 100,000 mechanical 
cycles over full temperature ranges verified 
continued cable functionality. 

Control Systems 

The FTS manipulator control design provides 6- 
DOF active control over a wide range of payloads 
as well as impedance control for stable contact. 
The wide payload range specified for the FTS 
manipulator causes the manipulator joints to 
experience inertial loads over several orders of 
magnitude. These loads are induced by the 
coupling which occurs between joints and affects 
the trajectory-tracking accuracy of the manipulator. 
The position controller implemented in the FTS 
manipulator compensates for these torques with a 
model-based inertia decoupler. The feed-forward 
decoupling scheme computes expected inertial 
torques due to commanded motion and sums this 
torque with the joint command. The position- 
dependent inertia matrices used to calculate these 
torques are computed every 200 ms, a time 
chosen as a compromise of accuracy and 
computational burden. 

In addition to the free-space performance 
requirements, satisfied with the position controller 


and inertial decoupler, the FTS manipulator must 
provide stable contact with its impedance control 
(see Figure 5). The Impedance controller Is 
position-based, that is, the manipulator and joints 
are treated as actuators of Cartesian position. 
Thus, end-effector force measurements are 
transformed Into Cartesian motion commands 
based on a desired output impedance. To 
maintain stability during the transition from free- 
space motion to contact, a Joint velocity feedback 
term Is included for "augmented damping." The 
resulted lightly damped contact insures stability, 
but when contact is broken the free-space motion 
becomes overdamped and sluggish. A feed- 
forward velocity term is Implemented to 
compensate for this poor free-space response. 
These control schemes, which increase the 
complexity of the controller are designed to meet 
the FTS free-space motion, payload capacity, and 
contact performance requirements. 

Emergency Shutdown 

An emergency shutdown (ESD) system is 
embedded in the manipulator control architecture. 
This system was implemented to provide active 
control of hazards to meet the payload safety 
requirement to be two-fault tolerant against 
catastrophic hazards. The primary hazards in this 
case are unplanned contact and excessive force 
generation. The ESD approach is to use 3 control 
levels to monitor joint and Cartesian positions and 
velocities, comparing both commands and sensor 
feedback. A separate ESD bus, which connects 
the joint, manipulator, and power controllers, is the 
path by which an ESD Is initiated - removing power 
from the manipulator systems. The first level 
checks that commanded values are within 
allowable limits both in the manipulator controller 
and the Joint controllers. The second level 
monitors safety critical parameters such as position, 
velocity, and torque with the joint controllers and 
within the manipulator controller collision 
avoidance routines. The final level of ESD 
monitoring is a check of redundant safety critical 
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Figure 5 - Manipulator Impedance Control Block Diagram 







parameters in the redundant manipulator controller 
and in independent joint controllers. 

In the event of an apparent failure, several possible 
ESD actions may be automatically initiated. The 
operator, of course, has a manual ESD to power off 
the manipulator at any time. If monitored values are 
elevated but do not pose immediate danger, a soft 
stop is initiated by the control software. A soft stop 
commands the manipulator to hold the current 
position with brakes off (disengaged). An example 
of a soft stop condition is a Cartesian manipulator 
command which violates a warning boundary near a 
known obstacle. A hardware ESD is initiated by 
any controller when an analog sensor value 
exceeds its limit value - resulting in an ESD 
notification on the ESD bus. These analog 
comparisons are being performed at 1500 Hz. A 
software ESD occurs when a controller CPU 
detects an out-of-limit condition and signals the 
power module over the Mil-Std-1 553B 
communication bus. The power module then 
initiates a combination ESD to power off the 
manipulator. A combination ESD is detected by 
software comparisons in the controllers and 
initiates a software reset of a hardware limit value to 
force a hardware ESD. All these ESD paths were 
analyzed to determine reaction times to various 
failures such as a joint runaway. Hardware ESDs 
occur in 1 1 msec, combination ESDs occur in 30 to 
206 msec, and a combination ESD may take up to 


4026 msec for an over-temperature condition. 

Gripper/End-of-Arm Tooling 
The end-of-arm tooling built for the FTS 
manipulator has a parallel jaw gripper and space for 
later addition of an end-effector exchange 
mechanism. This gripper and wrist mounted 
camera and lights are shown in Figure 6. The 
gripper fingers are a cruciform designed for 
positive contact and retention. The gripper fingers 
ride on a rack and pinion driven by a harmonic drive 
transmission and a single DC-motor. A pair of fail- 
safe brakes are installed to provide fault tolerance 
against inadvertent release. Each of the two 
brakes can withstand forces greater than expected 
gripper forces (maximum anticipated load is 30 lb, 
brake hold is 50 lb). Gripper forces are measured 
by a torque sensor and also by motor currents. 
The concern over inadvertent release also 
impacted the design of planned task items. These 
items were instrumented to insure positive grasp. 
As a final safety measure, the gripper fingers are 
attached with EVA compatible bolts which may be 
removed on-orbit to release the gripper. 

Safety Requirements 

Robotic Manipulator Systems can provide the 
capability to perform work and assist humans in 
space as long as they are safe and reliable. The 
space based requirements differ significantly from 



Figure 6 - End-of-Arm Tooling/Gripper 


terrestrial based manipulators used in Industry and 
research. In most terrestrial robot Implementations, 
the prime method for dealing with failures Is to 
keep workers out of the robot workspace when 
active and by accepting the occasional parts 
damage following a failure due to high volume parts 
fabrication. This approach is not acceptable for 
space applications where humans are Involved, the 
effects are very high in costs or It's extreme 
difficulty to repair. These effects Impact the design 
requirements for space manipulator systems. 

Ha7arris and Controls 

All manned space flight systems are assessed for 
flight hazards their use would Impose. From such 
an assessment the causes of those hazards are 
determined, and methods to control those hazards 
are developed. To gain flight acceptance, multiple 
levels of hazard control must be designed and 
verified to assure the desired level and coverage of 
controls. In the FTS system development, safe 
control of hazardous operations forced additional 
requirements in the design of the manipulator 
system, its interfaces with the Orbiter and the task 
elements the FTS was to interact with. 

The primary hazards associated with the FTS 
manipulator operations and the three methods for 
providing safe control are as listed: 

A) Unplanned contact or impact during operations 

1) Operator and computer control to not 
command unplanned contact. 

2) Boundary management software operation. 

3) Redundant boundary management software 
operation in the safety computer 

B) Inadvertent release of hardware 

1) Hardwired enable gripper brake power from 
independent switch in the aft flight deck 

2) Operator Interface Computer: (the aft flight 
deck portable laptop computer) command to 
release gripper Brake #1 

3) Hand controller switch to release gripper 
Brake #2 

C) Failure to stow for safe Orbiter landing 

1) Normal computer operations (With hardwired 
control for added reliability) 

2) Jettison via RMS (or EVA if time permits) 

3) EVA operations to stow or jettison 

D) Excessive applied gripper force or torque 

1) Force control using gripper force sensor 

2) Current limiting ESD (Emergency shutdown 
detection) 

3) Redundant current limiting ESD 

E) Excessive applied manipulator force or torque 

1) Normal control with active Cartesian load from 

joint torque command 


2) Cartesian force limiting, using wrist 
force/torque sensor channel A 

3) Redundant Cartesian force limiting, using 
wrist force/torque sensor channel B. 

Mission Operation To Control Hazards 
Primary concerns in the design of space 
manipulator systems have to do with the effects of 
system failures on the crew or vehicle. Operational 
limitations of use are placed on robotic systems 
that may otherwise be perfectly capable of 
performing their intended operations. Limitations 
on use are imposed due to the fact that if a system 
is performing a task and were to have a failure, the 
effect of that failure must not prohibit the intended 
function from being performed in the time frame 
that function is critically needed, and any failure 
must not prohibit any other safety related 
operations from being carried out during its time of 
criticality. 

For a system to continue operations after a failure, 
any remaining operability the system might contain 
must also provide that same capability to make itself 
safe to the vehicle and crew if it were to suffer a 
failure. Otherwise that additional level of operability 
would only be allowed for temporary use to make 
the task situation safe, remove the robot from the 
task area, and then stow It In a safe returnable state 
or eject it so the vehicle can return to Earth. The 
added operability would not be allowed for 
continued use to proceed with the intended task, 
except to make the situation safe. This Is the 
fundamental concept of hazard control for the 
Orbiter. 

FTS Fail Safe Operations 

Several FTS configuration descriptions follow 
below along with design features to address key 
functions which allow for safe operations. The 
designs comply with NASA’s Orbiter safety policy 
and requirements of NSTS f700.7B with 
interpreted in NSTS f8798A. In several cases, the 
hardware or software system could not be 
designed to meet the required levels of fault 
tolerance without significantly complicating the 
design or dexterity of the manipulator system. 
Therefore reductions in compliance with the safety 
requirements placed operational limitations on the 
use of the FTS System. The system is considered 
fail safe; where under any failure the system will not 
cause a catastrophic hazard, and therefore does 
not jeopardize the safety of the Orbiter or crew. 
The FTS system is not fail-operational. Such a 
system, after any initial failure, could continue 
normal intended operations since it would still 
retain the ability to make itself safe after a second 
failure. 


The DTF-1 concept fulfills the first method of 
hazard control for Oibiter safety using its normal 
modes of operation. If any of the single points of 
failure occur, normal operations will cease and an 
attempt to safe the manipulator system by use of 
the hardwired control. Note that hardwired control 
is only a supplement to the first level of hazard 
control. If the manipulator system cannot be safed 
by use of the hardwire control, the mission will be 
assessed to determine if enough time remains to 
perform an EVA to safe the manipulator system. If 
hardwired control cannot safe the manipulator 
system and time does not permit an EVA to safe 
the manipulator or remove It for stowage, then the 
RMS will grapple the telerobot using the RMS 
grapple fixture for Jettison. This is the second 
method for hazard control. The third method of 
hazard control to provide two fault tolerance for 
Orbiter safety is EVA operations. Remedial 
operations could be to remove the manipulator, 
release the gripper and/or release the actuator 
brakes. This would be to allow stowage of the 
manipulator, either into its caging devices or by 
removal and strapping it in the airlock, or otherwise 
by release into orbit. 

Hardwired Control 

The FTS system incorporates a backup hardwired 
control capability in the event of a failure which 
precludes closed loop computer control of the 
manipulator system. The main purpose is to 
minimize the likelihood of having to Jettison the 
system or perform an EVA operation. This has the 
effect of making the computer system, sensor 
systems, software, servo systems and most other 
hardware single fault tolerant, even though the 
operations would be significantly degraded in 
performance. 

Operational use of the hardwired control is limited 
to safing of the system after a failure, by stowing 
the arm to allow a safe Orbiter return. It allows 
operator control of individual manipulator joints for 
stowage and for gripper actuation In the event of 
computer control or motor drive failure. When 
selected, primary power is removed from all 
manipulator motor and brake drivers while retaining 
power to camera controls. Software recognizes 
the status of the hardwire control, and commands 
off all motors and brakes, so that return to normal 
computer operations after hardwired control starts 
with all motors and brakes powered off. 

Hardwire control is limited to very low joint rates and 
torques. Hardwired control is by sequential, jolnt- 
by-joint movement, and provides no force 
accommodation to minimize forces Imparted into 
interfaces. Only a limited set of initiated tasks are 


likely to be able to be completed. Emergency 
shutdown detection (ESD) is not operational 
during hardwired control operation, as the operator 
can de-power the hardwired drive to stop payload 
motion, and brakes can also be used to stop 
motion. 

EVA Operations 

Several failures of components employ EVA as the 
third hazard control path to ensure stowage of 
DTF-1 for safe return of the Orbiter. The 
manipulator actuators, gripper mechanism, and 
manipulator caging mechanisms represent major 
groups of such components. 

Failure of a caging mechanism to release the arm 
for operation would not require EVA for safing the 
manipulator. EVA would be used as the third path 
for safing the manipulator if more than one of the 
four caging mechanism fail to close. In this case, 
removal of the manipulator at its shoulder interface 
and either manual release into orbit or stowage In 
the airlock would be required. 

Failure of a manipulator actuator motor drive 
electrically or mechanically would require EVA as 
the third controlled path. Mechanical release of the 
joint actuator brake allows EVA backdrive of the 
joint into the caging position. If a manipulator joint 
seizes, then EVA is employed as the third hazard 
control path to remove the manipulator at the 
shoulder and release into orbit or stowage in the 
airlock. 

Single-Points Failures; 

There are several single point failures that remain in 
the FTS system which may lead to failure of the 
manipulator to complete a task, or to stow itself for a 
safe Orbiter return. For the Orbiter this is 
considered a catastrophic hazard, therefore the 
requirements for payloads to provide two fault 
tolerant methods of dealing with these effects. 

The FTS single-point failures which lead to an EVA 
or jettison are few in function, but have 
commonalty within the actuator and gripper. These 
failures are seized bearings or gears, a short within 
the motor winding, or a short or open in a brake 
winding. 

Safety Critical Subsystems 
The DTF-1 Flight Experiment of FTS has fifteen 
different safety critical subsystems and equipment 
groups, as listed: 

Structure Subsystem, Manipulator, Controls, Data 
Management and Processing, Vision, Sensors, 
Software, End-of-Arm Tooling, Electrical, Power, 


Electromechanical Devices, Thermal Control, Task 
Panel Elements, Aft Deck Workstation, and Hand 
Controllers 


Current Status 

The flight FTS manipulator assembly and initial 
tests were completed under the FTS Technology 
Capture program at Martin Marietta Astronautics, 
Denver, in July 1993. An acceptance test and 
demonstration occurred July 28, 1993, with NASA 
participation by JSC and LaRC. The tests were 
conducted on an air-bearing table with all seven 
joints active, but only four commanded to move for 
joint and coordinated Cartesian control. The joint 
servo controller loops had not been individual 
tuned, and therefore this testing constituted only a 
demonstration of operation, rather than a 
performance test. Contact stability and variable 
compliance interactions with external structures 
were also demonstrated. The servo tuning can be 
readily accomodated, as all parameters are 
programmable, including the torque loop 
frequency responses. 

A follow-on effort called the Bridge Task integrated 
and checked-out the flight End-of-Arm Tooling 
(EOAT or gripper) and wrist camera onto the flight 
manipulator. The Mil-Std-1 553B communications 
bus underwent performance tests between the 
three internal arm control computers and external 
coordinating controllers. Martin Marietta provided 
engineering assessments for a proposed flight 
experiment concept that separated the 
manipulator arm from the main avionics. The 
integrated safety design and control of the system 
was meticulously maintained. All engineering, 
analysis, data files and article data packages are 
being completed and documented under the 
guidance of Martin Marietta's QA and NASA's 
SR&QA to maintain the flight heritage of the 
manipulator and components. 


NASA Flight Plana 

JSC developed an Orbiter based flight experiment 
concept to demonstrate a dexterous robotic 
manipulator system that can operate on the end of 
the Shuttle Remote Manipulator System (SRMS). 
This configuration was recommended by Shuttle 
payload and operations managers as the most 
useful and beneficial, as opposed to a relocateable 
dexterous device only. The operational uses allow 
planned payload manipulation tasks and provides a 
capability for contingency operations for payloads 
and for some Orbiter problems. The benefit is to 
minimize overall EVA time currently consumed by 
routine tasks, such as EVA site setup and 
takedown. This would allow EVA to be most 
usefully allocated for complex operations. Langley 
Research Center and JPL are team participants in 
this proposed venture, called DOSS for Dexterous 
Orbiter Servicing System. Langley would be 
responsible for advanced robotic controls 
development and JPL for advanced operator 
control from a ground control station. 

The other significant function of DOSS includes 
ground control of the dexterous manipulator using 
3-D graphic simulations in predictive displays to 
compensate for the time delays. Ground control 
allows multiple rotations of ground controllers to 
operate the dexterous manipulator. The flight 
experiment concept is cost effective, in that the 
most expensive development item, the flight 
manipulator, is available and can be capitalized on. 
The manipulator along with all ancillary avionics and 
mechanisms were designed to meet the integrated 
and operational Orbiter payload safety 
requirements. Such a flight experiment would 
provide significant risk mitigation for robotic 
applications in space, e.g. the new space station, 
since much of its maintenance is now baselined 
with the use of ground controlled robotics. The 
station program seems to be counting on 
dexterous robotics with no flight operations time to 
provide insight into possible complications. 
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